Risk and Compliance in Adaptive Delivery
Core Concepts
Risk management in Agile is iterative and integrated into planning. Key practices include risk-adjusted backlog (prioritizing high-risk items early), spikes (to reduce uncertainty), and risk burndown charts. Compliance in regulated environments requires balancing Agile flexibility with necessary documentation and controls. Candidates must understand that Agile does not mean no documentation-it means right-sized documentation. Risk response strategies include avoid, mitigate, transfer, accept, and exploit.
Traps
A frequent trap is ignoring compliance until the end. Questions may ask how to handle regulatory requirements in an Agile project; the answer often involves including compliance criteria in the definition of done and engaging compliance experts early. Another trap is treating risk management as a one-time event rather than continuous. Also, beware of answers that avoid risk entirely-some risk is necessary for innovation.
Worked Example
A team building a medical device must comply with FDA regulations. They include regulatory documentation as part of the definition of done for each increment and conduct regular audits. This integrates compliance into the iterative process rather than bolting it on at the end.
Rule of Thumb
Address high-risk, high-value items early; integrate compliance into the definition of done.